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SUMMARY  of  CHANGE 

AR  11-7 

Internal  Review  and  Audit  Compliance  Program 
Specifically,  this  revision — 

o  Incorporates  changes  to  the  Army's  Internal  Review  Program  resulting  from 
reengineering . 

o  Revises  policies  to  facilitate  the  delivery  of  internal  audit  services. 

o  Formalizes  an  Internal  Review  Steering  Group  at  Army  level  (para  1-4) . 

o  Adds  internal  audit  services  to  those  traditionally  provided  to  commanders 
and  their  staffs  (para  1-6,  chaps  4-6) . 

o  Adds  provisions  for  web-based  reporting  of  semiannual  reports  (para  6-3) . 
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History.  This  printing  publishes  a 
revision  of  this  publication.  Because  the 
publication  has  been  extensively  revised, 
the  changed  portions  have  not  been 
highlighted. 

Summary.  This  regulation  contains  poli¬ 
cies  for  establishing  and  operating  an  in¬ 
ternal  review  activity  within  an  Army 
organization. 

Applicability.  This  regulation  applies  to 
the  Active  Army  (AA),  the  Army  Na¬ 
tional  Guard  of  the  United  States 
(ARNGUS),  and  the  U.S.  Army  Reserve 


(USAR).  The  ARNGUS  is  a  reserve  com¬ 
ponent  of  the  Army  that  maintains  a  dual 
state  administered  status,  as  the  Army  Na¬ 
tional  Guard  (ARNG).  This  regulation 
also  applies  to  the  ARNG,  except  as  indi¬ 
cated  herein. 

Proponent  and  exception  authority. 

The  proponent  for  this  regulation  is  the 
Assistant  Secretary  of  the  Army  (Finan¬ 
cial  Management  and  Comptroller)  (ASA 
(FM)).  The  ASA  (FM)  has  the  authority 
to  approve  exceptions  to  this  regulation 
consistent  with  controlling  law  and  regu¬ 
lation.  The  ASA  may  delegate  this  ap¬ 
proval  authority,  in  writing,  to  a  division 
chief  within  the  proponent  agency  in  the 
grade  of  Colonel  or  the  civilian 
equivalent. 

Army  management  control  process. 

This  regulation  contains  management  con¬ 
trol  provisions  in  accordance  with  AR  11- 
2  but  does  not  identify  key  management 
controls  that  must  be  evaluated. 
Supplementation.  Supplementation  of 
this  regulation  and  establishment  of  com¬ 
mand  and  local  forms  are  prohibited  with¬ 
out  prior  approval  from  Assistant 
Secretary  of  the  Army  (Financial  Manage¬ 
ment  and  Comptroller),  ATTN:  SAFM- 


FOI,  109  Army  Pentagon,  Washington, 
DC  20310-0109  or  InternalReview@hqda. 
army.mil. 

Suggested  Improvements.  Users  are 
invited  to  send  comments  and  suggested 
improvements  on  DA  Form  2028  (Recom¬ 
mended  Changes  to  Publications  and 
Blank  Forms)  directly  to  Assistant  Secre¬ 
tary  of  the  Army  (Financial  Management 
and  Comptroller),  ATTN:  SAFM-FOI, 
109  Army  Pentagon,  Washington,  DC 
20310-0109  or  IntemalReview@hqda.ar- 
my.mil. 

Distribution.  This  publication  is  availa¬ 
ble  in  electronic  media  only  and  is  in¬ 
tended  for  command  levels  C,  D,  and  E 
for  the  Active  Army,  the  Army  National 
Guard  of  the  United  States  (ARNGUS), 
and  the  U.S.  Army  Reserve  (USAR). 
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Chapter  1 
Introduction 

1-1.  Purpose 

This  regulation  prescribes  the  policies,  role,  and  responsibilities  of  the  Internal  Review  (IR)  Program  within  the 
Department  of  the  Army  (DA). 

1-2.  References 

Required  and  related  publications  and  prescribed  and  referenced  forms  are  listed  in  appendix  A. 

1-3.  Explanation  of  abbreviations  and  terms 

Abbreviations  and  special  terms  used  in  this  regulation  are  explained  in  the  glossary. 

1-4.  Responsibilities 

a.  The  Assistant  Secretary  of  the  Army  (Financial  Management  &  Comptroller)  (ASA  (FM&C))  has  Headquarters 
Department  of  the  Army  (HQDA)  Staff  responsibility  for  the  IR  Program.  The  Deputy  Assistant  Secretary  of  the  Army 
(Financial  Operations),  (DASA-FO),  will  provide  oversight  and  direction  for  the  IR  Program. 

b.  The  Director,  Management  Services  and  Internal  Review  is  responsible  to  the  DASA-FO  for  management  of  the 
IR  Program  and  will — 

(1)  Interpret  and  implement  Comptroller  General  of  the  United  States  and  DOD  standards  and  policies  as  they  relate 
to  IR. 

(2)  Promulgate  DA  audit  policies  established  by  The  Auditor  General. 

(3)  Develop  IR  policy. 

(4)  Participate  with  The  Auditor  General  in  implementing  policies  and  procedures  for  processing  external  audit 
reports  and  follow-up  on  findings  and  recommendations. 

(5)  Ensure  effective  execution  of  IR  Programs  at  major  Army  commands  (MACOMs),  Army  Staff  agencies,  and 
other  organizations  where  IR  offices  are  established. 

(6)  Provide  guidance  and  assistance  to  organizations  reporting  to  HQDA. 

(7)  Participate  with  The  Auditor  General  in  his  role  as  the  deputy  functional  chief  representative  in  overseeing  IR 
auditor  training. 

(8)  Advise  commanders  and  activity  heads  on  maintaining  adequately  staffed  IR  offices  with  an  appropriate  grade 
structure. 

(9)  Establish  an  Internal  Review  Steering  Group  (IRSG)  to  recommend  IR  policy  and  program  changes  and  to 
develop  strategic  plans.  Membership  in  the  IRSG  will  include  IR  Directors/Chiefs  as  follows: 

(a)  U.S.  Army  Materiel  Command. 

(b)  U.S.  Army  Training  &  Doctrine  Command. 

(c)  U.S.  Army  Eorces  Command. 

(d)  U.S.  Army  Corps  of  Engineers. 

(e)  U.S.  Army  Europe  &  Seventh  Army. 

(f)  U.S.  Army  Medical  Command. 

(g)  U.S.  Army  Pacific. 

(h)  U.S.  Army  Community  and  Eamily  Support  Center. 

(i)  National  Guard  Bureau. 

(j)  U.S.  Army  Reserve  Command. 

(k)  Additionally,  the  Director,  Management  Services  and  Internal  Review  will  select  up  to  five  ’at-large’  members 
who  will  serve  on  an  annual  basis.  At-large  members  may  be  re-appointed  for  consecutive  terms. 

c.  The  Auditor  General  of  the  Army  will — 

(l)  Establish  audit  policies  and  standards  for  all  auditors  in  the  Army. 

(2)  Establish  professional  training  matrixes  for  all  Army  auditors,  both  the  U.S.  Army  Audit  Agency  (USAAA)  and 
IR,  as  specified  in  a  memorandum  of  agreement  with  the  ASA  (EM&C). 

(3)  Provide  Army  IR  offices  with  audit  guides  prepared  by  the  USAAA.  As  available  and  requested,  provide  audit 
guides  from  other  federal  audit  organizations. 

(4)  Perform  periodic  external  quality  assurance  (QA)  reviews  of  the  IR  Program,  as  necessary. 

(5)  Establish  policies  and  procedures  for  processing  USAAA  reports,  external  reports,  and  performing  follow-up  on 
audit  findings  and  recommendations. 

(6)  Ensure  the  effective  execution  of  the  Army  Eollow-up  Program  by  monitoring  implementation  of  corrective 
actions  taken  by  responsible  commands  or  HQDA  elements. 

(7)  Perform  selective  on-site  visits  of  HQDA  activities  and  commands  to  evaluate  the  effectiveness  of  follow-up 
systems. 
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(8)  Serve  as  the  DA  point  of  contact  for  receipt,  assignment,  coordination,  and  control  of  audit  announcements, 
drafts  and  final  reports,  follow-ups  and  security  reviews  between  GAO,  DODIG,  and  the  Army. 

d.  Commanders  at  all  levels,  heads  of  HQDA  activities,  and  USPFOs  will — 

(1)  Develop  and  execute  an  annual  IR  plan.  This  plan  should  be  sufficiently  flexible  to  permit  internal  audit 
resources  to  focus  on  command’s  most  pressing  needs  in  a  timely  manner. 

(2)  Establish  and  maintain  an  effective  audit  follow-up  program  and  provide  liaison  services  to  both  internal  and 
external  audit  organizations  such  as  the  General  Accounting  Office  (GAO);  The  Inspector  General,  Department  of 
Defense  (DODIG);  or  the  USAAA  as  prescribed  in  AR  36-2. 

(3)  Provide,  to  the  extent  that  resources  permit,  IR  services  to  support  tenant  activities  whose  organizational 
structure  does  not  provide  for  internal  audit  capability. 

(4)  Establish  a  formal  QA  Program  in  accordance  with  Government  Auditing  Standards  (GAS)  and  this  regulation  to 
evaluate  the  quality  and  level  of  service  provided  by  the  IR  organization  and  by  subordinate  IR  elements.  The  QA 
Program  will  include  formal  annual  self-evaluations  and  an  external  review  not  less  than  once  every  three  years.  QA 
reviews  will  evaluate  organization  and  staffing,  program  management,  audit  planning,  audit  process,  audit  compliance 
and  liaison,  and  consulting  and  other  advisory  services.  Each  QA  review  will  also  address  the  overall  effectiveness  of 
IR  elements  to  include  customer  satisfaction  and  value  added  to  the  local  command.  The  DA  QA  Guide  will  be  used  to 
perform  internal  and  external  QA  reviews. 

(5)  Ensure  subordinate  IR  offices  receive  external  QA  reviews  at  least  once  every  3  years.  The  DA  Staff/MACOM 
headquarters  IR  office,  USAAA,  DODIG,  or  other  external  professional  audit  organization  may  accomplish  the  external 
review. 

(6)  Ensure  the  IR  office’s  organizational  alignment  is  located  outside  the  normal  staff,  reporting  directly  to  the 
commander  (installation/garrison/separate  activity),  principal  deputy  commander,  or  chief  of  staff. 

(7)  Ensure  that  state-level  National  Guard  IR  auditors  are  organizationally  aligned  under  and  report  to  the  U.S. 
Property  and  Eiscal  Officer  (USPEO),  the  independent  Eederal  official  in  each  state,  in  accordance  with  National  Guard 
Regulation  130-6. 

(8)  Ensure  IR  auditors  are  granted  full  and  unrestricted  access  (consistent  with  their  security  level)  to  all  files, 
electronic  and  otherwise,  needed  in  connection  with  an  audit,  inquiry,  or  other  IR  service. 

(9)  Ensure  auditors  at  the  direct  operating  level  are  working  in  accordance  with  the  established  Army  Civilian 
Personnel  Occupation  Standard  (CPOS). 

(10)  Ensure  that  assigned  IR  personnel  complete  professional  auditor  training  prescribed  by  The  Auditor  General,  or 
equivalent  training  taken  to  comply  with  continuing  professional  education  (CPE)  requirements  prescribed  by  GAS. 
Where  appropriate,  have  an  additional  skill  identifier  (ASI)  awarded  to  military  auditors. 

(11)  Ensure  that  Army  Special  Access  Programs  (SAP)  are  included  in  the  audit  cognizance  of  the  command’s  IR 
Program.  At  least  one  IR  auditor  should  be  cleared  for  access  to  the  command’s  SAP.  The  IR  auditor  will  ensure  that 
SAP  managers  are  aware  of  the  audit  services  IR  elements  can  provide.  Additionally,  the  command’s  IR  office  will 
serve  as  the  audit  focal  point  for  external  SAP  audits,  with  one  allowable  exception;  MACOMs  with  designated  SAP 
central  offices  can  designate  themselves  as  the  focal  point  for  all  SAP  audits.  When  multiple  commands  share 
responsibility  for  a  particular  SAP,  each  command  will  coordinate  audit  cognizance  through  the  Army’s  Deputy  Chief 
of  Staff-Operations  (DACS-DMP)  to  ASA  (EM&C). 

e.  The  IR  officer  will — 

(1)  Serve  as  the  commander’s  principal  advisor  on  all  audit  matters. 

(2)  Direct,  manage,  and  execute  the  full  range  of  internal  auditing  services  prescribed  in  this  regulation  consistent 
with  the  needs  of  their  customers. 

(3)  Prepare  a  flexible  IR  plan  (schedule)  that  meets  the  needs  of  the  command  and  other  serviced  organizations. 

(4)  Ensure  IR  services  are  delivered  in  accordance  with — 

(a)  Government  Auditing  Standards. 

(b)  DOD  Internal  Audit  Standards  and  policies. 

(c)  Comptroller  General  Standards  for  Internal  Control  in  the  Eederal  Government. 

(d)  Army  policies  outlined  in  this  regulation. 

(5)  Provide  technical  advice,  assistance,  and  consultation  on  management  controls  to  assessable  unit  managers 
within  their  organizations  as  necessary. 

(6)  During  the  normal  course  of  audits,  evaluate  the  effectiveness  of  management  controls  and  the  adequacy  of 
management  control  evaluations  and  actions  taken  to  correct  material  weaknesses. 

(7)  Ensure  proper  career  development,  including  professional  training  programs,  of  all  assigned  IR  personnel. 

(8)  Ensure  that  weaknesses  identified  through  internal  and  external  audits  are  considered  during  preparation  of  the 
commander’s  annual  assurance  statement  in  accordance  with  AR  11-2. 

(9)  If  aligned  at  the  headquarters  of  a  reporting  organization,  review  the  organization’s  annual  management  control 
assurance  statement  and  provide  the  commander  an  assessment  of  its  thoroughness  and  validity. 
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(10)  Establish  and  maintain  an  audit  recommendation  tracking  system  and  an  effective  follow-up  system  on  both 
internal  and  external  audit  reports  in  accordance  with  AR  36-2. 

(11)  Serve  as  the  commander’s  principal  official  for  liaison  with  external  audit  organizations  (GAO,  DODIG, 
USAAA),  including — 

(a)  Assisting  command,  in  coordination  with  HQDA  elements,  with  assessing  audit  objectives,  sites,  milestones,  and 
other  information  on  audits  about  to  start. 

(b)  Arranging  entrance  conferences,  discussions,  and  exit  conferences  with  both  internal  and  external  audit  organiza¬ 
tions  and  the  appropriate  organization  officials. 

(c)  Providing  administrative  support  to  external  audit  organizations,  when  possible. 

(d)  Ensuring  accurate,  adequate,  responsive,  and  coordinated  comments  are  provided  to  ’draft’  audit  findings  and 
recommendations. 

(e)  Incorporating  official  command  responses  in  findings  and  recommendations  from  the  USAAA.  Command 
responses  must  be  coordinated  with  higher  headquarters  and  DA  Staff  elements  to  ensure  that  they  represent  the 
official  Army  position. 

(12)  Ensuring  military  IR  auditors  are  awarded  appropriate  skill  identifier/additional  skill  identifier  (Sl/ASI)  in 
accordance  with  criteria  established  by  the  U.S.  Total  Army  Personnel  Command  (PERSCOM). 

(13)  Submitting  management  and  productivity  reports  to  HQDA  semiannually  or  as  required. 

1-5.  Staff  relationships 

a.  IR  should  be  an  integral  part  of  the  command/installation  management  team  along  with  The  Inspector  General, 
resource  manager,  and  other  staff  elements  and  will  work  closely  with  these  elements  to  achieve  a  complementary 
effort.  The  IR  officer  will  be  aligned  as  both  a  personal  and  special  staff  officer.  As  a  member  of  the  commander’s 
personal  staff,  the  IR  officer  will  have  direct  access  to  the  commander  whenever  required.  At  other  times,  the  IR 
officer  will  function  as  a  member  of  the  special  staff. 

b.  The  IR  officer’s  official  rating  will  consider  results  from  an  external  quality  assurance  visit  when  conducted/ 
reported  during  the  rating  period. 

1-6.  Internal  review  concept 

a.  It  is  incumbent  upon  Army  commanders  at  all  levels  to  establish  a  competent  system  of  internal  control.  The 
internal  control  system  will  promote  effectiveness  and  efficiency  of  operations,  assure  reliability  of  financial  reporting, 
and  ensure  compliance  with  applicable  laws  and  regulations.  Additionally,  each  commander  must  set  a  positive  and 
supportive  attitude  toward  internal  control  and  conscientious  management.  An  integral  part  of  the  commander’s  control 
system  is  his/her  internal  review  program.  It  can  be  used  to  monitor  risks  to  the  organization  and  to  assess  the  status 
and  effectiveness  of  all  other  internal  or  management  controls.  IR  offices  are  prescribed  for  most  commands  and 
activities  in  the  Army. 

b.  The  IR  office  will  provide  the  commander  and  his  or  her  staff  with  a  full  range  of  internal  auditing  services. 
These  include — 

(1)  Eormal  audits  in  accordance  with  paragraph  4-1. 

(2)  Quick  response  or  troubleshooting  audits  in  accordance  with  paragraph  4-2. 

(3)  Consulting  and  advisory  services  in  accordance  with  paragraph  5-1. 

c.  The  IR  office  will  serve  as  the  command  point  of  contact  with  both  internal  and  external  audit  organizations.  IR 
offices  will  be  responsible  for  facilitating  the  command  reply  process  by  assisting  the  command  in  developing 
comments  to  findings  and  recommendations.  IR  offices  will  also  conduct  audit  follow-up  and  report  on  management 
actions  to  correct  problems  identified  in  internal  and  external  audit  reports.  This  will  permit  the  command  to  realize  the 
benefits  from  audit  and  will  provide  the  commander  with  reasonable  assurance  that  reported  problems  have  been 
corrected  and  associated  risks  minimized  or  eliminated. 


Chapter  2 

The  Internal  Review  Program 
2-1.  Program  objective 

a.  Commanders  at  all  levels  are  responsible  for  accomplishing  their  mission  and  for  effective  stewardship  of  Eederal 
resources  provided  for  mission  accomplishment.  The  objective  of  the  Army’s  IR  Program  is  to  provide  commanders 
and  their  staffs  with  a  full  range  of  professional  internal  auditing  services  that  are  timely  and  that  support  local 
decision-making  and  effective  stewardship. 

b.  IR  can  serve  the  commander  and  his  or  her  staff  by  testing  other  systems  of  control,  recommending  new  or 
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modified  control,  or  using  control  self  assessment  techniques  to  assist  the  organization  in  minimizing  exposure  to  fraud, 
waste,  or  mismanagement. 

2-2.  Staffing 

a.  IR  resourcing  should  be  commensurate  with  assigned  responsibilities.  The  inventory  of  auditable  entities  and  the 
inventory  of  assessable  units  established  to  help  manage  local  risks  and  administer  the  management  control  process 
(MCP)  comprise  the  potential  workload  of  an  IR  organization  and  should  be  used  to  help  identify  manpower 
requirements. 

b.  The  IR  Staff  will  be  comprised  of  qualified  auditors  in  the  GS-511  series.  Grades  will  be  established  and 
maintained  in  accordance  with  the  Army  Civilian  Personnel  Occupation  Standard  (CPOS).  Temporary  augmentation  by 
military  and/or  civilian  functional  experts,  under  the  supervision  of  the  IR  officer,  is  authorized  to  meet  special 
technical  requirements  of  individual  audits.  In  exercising  discretion  to  augment  IR  staffs  under  this  paragraph, 
commanders  will  ensure  compliance  with  this  regulation.  Exceptions  to  the  hiring  of  fully  qualified  GS-511  auditors 
(that  is,  a  systems  analyst  or  industrial  engineer)  must  receive  prior  written  approval  from  the  Assistant  Secretary  of  the 
Army  (Financial  Management  and  Comptroller). 

c.  The  National  Guard  will  staff  USPFO  IR  offices  with  competitive  technicians  (Title  32)  or  civilian  employees 

(Title  5)  to  ensure  an  independent  attitude  and  appearance  is  maintained  and  to  fully  comply  with  GAS. 

d.  National  Guard  and  USAR  M-day  auditors,  if  not  fully  qualified  in  the  GS-511  series,  will  possess  or  be  working 
towards  the  award  of  the  additional  skill  identifier  (ASI)  established  by  U.S.  Army  Personnel  Command  (PERSCOM) 
for  military  auditors. 

e.  Contractor  augmentation  is  also  permissible  for  performance  of  A-76  study  validations  and  obtaining  specialized 
technical  expertise  not  available  within  the  on-board  audit  staff.  In  these  instances,  the  IR  office  will  perform  necessary 
contract  oversight. 

2-3.  Training 

a.  Proper  training  of  IR  personnel  is  essential  to  maintain  the  skills  and  knowledge  required  in  the  auditing 

profession.  Commanders  and  IR  officers  will  ensure  that  each  auditor  maintains  proficiency  through  continuing 
education  and  training  at  levels  prescribed  by  GAS  and  The  Auditor  General. 

b.  The  Auditor  General  of  the  Army,  in  concert  with  ASA  (FM&C),  will  prescribe  professional  training  for  IR 

auditors.  A  principal  source  of  training  for  IR  personnel  will  be  from  training  programs  sponsored  or  sanctioned  by 
The  Auditor  General  and  HQDA.  These  programs  are  intended  to  provide  uniform  auditor  training  and  expand 
individual  qualifications  to  enable  maximum  utilization  of  personnel  resources. 

c.  Auditors  engaging  in  approved  self-development  training  (graduate  courses,  special  courses,  certification  study, 
etc.)  that  meets  legal  regulations  and  requirements  will  be  reimbursed  as  long  as  training  funds  are  available. 
Commanders  and  IR  officers  are  encouraged  to  budget  and  reimburse  IR  staff  members  the  legal  maximum  amount  for 
tuition  costs  and  books  for  successfully  completed  courses  that  are  considered  sufficiently  related  to  present  or 
anticipated  job  duties  and  would  be  of  benefit  to  the  command  or  the  Army. 

d.  To  ensure  the  continued  high  professional  expertise  of  Army  IR  auditors.  Army  commanders  will  encourage  their 
auditors  to  seek  professional  certifications.  Job-related  review  courses,  such  as  Certified  Public  Accountant  (CPA), 
Certified  Internal  Auditor  (CIA),  Certified  Information  Systems  Auditor  (CISA),  Certified  Fraud  Examiner  (CFE), 
Certified  Defense  Financial  Manager  (CDFM),  Certified  Government  Financial  Manager  (CGFM),  and  other  related 
certification  courses,  shall  be  reimbursed  the  legal  maximum  amount  for  tuition  costs  when  possible.  In  addition,  IR 
officers  are  encouraged  to  grant  employees  an  excused  absence  on  examination  days.  Applicable  DOD  personnel 
regulations  permit  this  type  of  excused  absence  on  the  basis  that  such  an  absence  will  further  an  agency  function. 

e.  Professional  proficiency  is  a  personal  obligation  and  each  IR  auditor  is  responsible  for  maintaining  current  skills 
and  techniques.  Failure  to  meet  continuing  professional  education  requirements  robs  commanders  and  their  staffs  of  the 
ability  to  apply  cutting  edge  capabilities  to  local  problems. 

f.  Personnel  employed  by  the  IR  office  who  are  not  qualified  auditors  (in  this  instance,  GS-511),  will  be  required  to 
attend  auditor  training  courses  to  achieve  a  working  knowledge  of  audit  standards,  policies,  and  techniques. 

2-4.  Audit  scope 

a.  The  scope  of  work  performed  by  the  IR  office  can  encompass  all  aspects  of  management  and  management  control 
and  all  programs,  functions,  transactions,  records,  systems,  and  documents.  Properly  cleared  auditors  will  be  entitled  to 
full  and  unrestricted  access  to  all  personnel,  facilities,  records,  reports,  databases  (read  only),  documents,  or  other 
information  or  material  needed  to  accomplish  an  announced  audit  objective.  Only  the  commander  may  deny  IR 
auditors  access  to  an  area  under  his  or  her  control. 

b.  IR  services  will  normally  include  performance  audits,  financial  audits,  quick  response  audits,  audit  compliance, 
and  other  consulting  or  advisory  services.  In  determining  the  type  of  service  to  be  provided,  the  IR  officer  will 
evaluate,  among  other  considerations,  how  the  information  will  be  used  and  the  time  available  for  the  work. 
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2-5.  Policy  relationships 

There  are  several  organizations  external  and  internal  to  the  Army  whose  operations  affect  IR  operations  and  with 
whom  liaison  is  maintained.  The  most  commonly  encountered  organizations  are — 

a.  GAO.  The  GAO  is  an  element  of  the  legislative  branch  of  the  U.S.  Government  and  performs  audits  and  surveys 
of  governmental  organizations  or  functions  as  directed  by  the  Congress. 

b.  DODIG.  The  DODIG  may  initiate,  conduct,  and  supervise  such  audits  in  the  DOD  as  The  Inspector  General 
considers  appropriate  or  that  have  been  requested  by  the  Secretary  of  Defense. 

c.  USAAA.  The  US  AAA  is  the  DA’s  central  internal  audit  organization  operating  under  The  Auditor  General  of  the 
Army.  USAAA  furnishes  expert  audit  services  to  HQDA  activities  and  Army  commands  on  the  effectiveness  of  Army 
programs.  USAAA  will  assess  the  status  of  corrective  actions  to  audit  findings. 

d.  DAIG.  The  Office  of  The  Inspector  General  and  the  U.S.  Army  Inspector  General  Agency  provide  the  Secretary 
of  the  Army  and  the  Chief  of  Staff,  Army  with  periodic  reports  on  the  discipline,  efficiency,  economy,  morale,  training, 
and  readiness  throughout  the  Army.  The  Office  of  The  Inspector  General  and  the  U.S.  Army  Inspector  General  Agency 
provides  DA  with  a  continuing  assessment  of  the  command,  operational,  logistical,  and  administrative  effectiveness  of 
the  Army. 

e.  CID.  The  Criminal  Investigation  Division  provides  crime  investigation  support  to  Army  commands  and  often 
works  closely  with  USAAA  and  local  IR  offices. 

2-6.  Guidance 

a.  Commanders  may  use  IR  resources  in  any  role  consistent  with  the  concepts  and  policies  contained  in  this 
regulation.  In  exercising  this  broad  discretion,  commanders  will  consider  the  following: 

(1)  Cyclic  audits  of  appropriated  fund  functions  or  activities  will  not  generally  be  scheduled  by  IR  offices  in  their 
annual  plans  unless  command  has  a  documented  need  warranting  such  a  resource  allocation. 

(2)  IR  personnel  will  not  normally  be  used  to  make  regularly  scheduled  audits  of  nonappropriated  fund  instrumen¬ 
talities  (NAFI)  having  a  cash  basis,  single  entry  system  of  accounts.  Normally,  disinterested  officers  will  audit  such 
funds.  When  utilized,  disinterested  officers  will  follow  the  principles  for  auditing  prescribed  herein  and  in  the  IR  Guide 
located  on  the  Internal  Review  Web  site. 

(3)  Normally,  IR  personnel  should  not  be  used  to  perform  periodic  or  cyclic  audits  of  private  organizations,  in  this 
instance.  Type  1 -Federally  Sanctioned  (Army  Emergency  Relief);  Type  2-Organization  (PTA);  or  Type  3-Independent 
(Thrift  Shops). 

(4)  IR  offices  will  not  perform  annual  unit  fund  audits. 

(5)  IR  personnel  may  be  called  upon  to  perform  audits  of  NAFIs,  unit  funds,  and  other  Federally  sanctioned  funds 
when  the  commander  believes  there  to  be  indications  of  fraud  or  misappropriation  of  funds  or  other  assets,  or  when 
warranted  by  the  volume  and  complexity  of  transactions. 

(6)  IR  officers  are  responsible  for  monitoring  disinterested  officer  audits  of  NAFIs  and  similar  funds  classified  as 
Government  instrumentalities.  This  requirement  includes  providing  guidance  regarding  the  conduct  of  the  audit, 
reviewing  and  retaining  the  work  papers,  and  ensuring  audit  results  are  valid  and  credible. 

(7)  IR  auditors  should  not  serve  in  operational  roles  outside  of  the  IR  organization.  An  IR  auditor  may  serve  in  an 
advisory  role  for  command  programs — that  is,  providing  advice  on  the  establishment  of  automated  systems,  process 
action  teams,  source  selection  evaluation  boards  (SSEB),  or  implementation  of  the  command’s  management  control 
process  (MCP) — as  long  as  a  requisite  degree  of  independence  can  be  maintained. 

(8)  IR  auditors  may  serve  as  the  contracting  officer’s  technical  representative  (COTR)  for  audit  or  consulting  work 
outsourced  to  private  vendors.  This  includes  OMB  Circular  A-76  validations. 

b.  The  commander,  in  consultation  with  the  IR  officer,  will  determine  whether  the  performance  of  a  particular 
service  is  consistent  with  the  requirement  to  preserve  and  protect  auditor  independence,  in  accordance  with  GAS. 


Chapter  3 

Internal  Review  Planning 
3-1.  Annual  planning 

a.  All  IR  offices  will  prepare  an  annual  IR  plan  (schedule)  containing  a  projected  workload  for  the  audit  staff.  Due 
to  the  dynamic  nature  of  the  Army  operating  environment,  IR  plans  must  be  flexible  enough  to  allow  for  high  priority 
unprogrammed  work  and  to  adequately  perform  audit  liaison  and  follow-up  missions. 

b.  Planning  emphasis  will  be  on  mission  functions  where  the  greatest  benefit  to  command  can  be  reasonably 
anticipated. 

c.  Planning  philosophy  will  encompass  the  following: 

(1)  Meeting  the  priority  needs  of  the  commander  and  his  or  her  staff. 

(2)  Making  effective  and  efficient  use  of  audit  resources. 
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(3)  Maximizing  coverage  of  high  risk,  high  pay  back  areas. 

(4)  Providing  internal  audit  coverage  to  all  functional  areas. 

(5)  Providing  for  audit  follow-up,  compliance,  and  liaison  requirements. 

d.  NAFIs  and  related  activities  should  compete  for  audit  coverage  with  appropriated  fund  activities  on  an  equal  basis 
or  as  directed  by  the  local  commander.  In  addition,  NAFIs  may  be  audited  on  a  functional  basis  as  a  result  of  guides 
prepared  jointly  by  USAAA  and  ASA  (FM&C)  for  the  audit  of  installation  morale,  welfare,  and  recreation  fund 
(IMWRF)  activities.  These  audits  are  programmed  as  a  result  of  the  Joint  Installation  Morale,  Welfare,  and  Recreation 
Fund  Oversight  Committee,  which  is  comprised  of  both  Community  and  Family  Support  Center  and  audit  personnel. 
Information  on  functional  audits  selected  for  review  during  a  specific  year  will  be  provided  MACOMs  for  inclusion  in 
the  IR  plan.  (Note:  This  paragraph  is  not  applicable  to  Chaplain  NAFIs.) 

e.  Guidance  for  the  development  and  maintenance  of  an  IR  Plan  is  contained  in  the  DA  Internal  Review  Guide. 
Copies  of  annual  updates  to  IR  plans  will  be  submitted  to  the  next  higher  headquarters.  MACOM  and  HQDA  Staff 
agencies  will  forward  an  information  copy  of  their  annual  updates  to  HQDA  ASA  (FM&C),  ATTN:  SAFM-FOI,  109 
Army  Pentagon,  Washington,  DC  20310-0109  by  20  October.  Copies  should  be  e-mailed  whenever  possible  to 
Intern  alRe  vie  w  @  hqda.  army.mil. 

3-2.  Auditable  entity  files 

a.  IR  offices  should  ensure  organizational  risks  are  reviewed  periodically  and  that  oversight  is  tracked.  To  accom¬ 
plish  this,  offices  will  use  an  auditable  entity  file  (AEF).  The  AEF  should  include  all  major  programs,  activities, 
functions,  or  systems  subject  to  audit. 

b.  The  organization’s  list  of  assessable  units,  prepared  in  accordance  with  AR  11-2,  Management  Controls,  can 
serve  as  the  AEE  but  may  require  modifications  to  include  the  broader  base  of  audit  responsibility  (in  this  instance, 
tenant  activities). 


Chapter  4 
Audit  Services 

4-1.  Formal  audits 

a.  Eormal  audits  (EAs)  should  be  performed  when  the  commander  or  other  customer  requires  a  broad,  comprehen¬ 
sive  evaluation  of  the  entity’s  effectiveness,  efficiency,  financial  position,  or  the  results  being  achieved  by  a  command 
program  or  function.  EAs  should  also  be  accomplished  when — 

(1)  There  is  a  high  potential  for  adverse  actions. 

(2)  There  is  suspicion  of  illegal  and/or  unethical  activity. 

(3)  The  entity  to  be  audited  presents  an  unusually  high  potential  risk  to  the  command. 

(4)  Time  is  not  a  major  consideration. 

(5)  The  results  of  the  audit  will  be  used  outside  of  the  command. 

b.  The  needs  of  the  commander  and  the  audit  resources  available  to  the  IR  officer  should  dictate  the  number  of  EAs 
performed.  Small  IR  offices,  in  particular,  should  consider  using  techniques  such  as  participatory  and  piecemeal 
auditing.  The  use  of  functional  experts  and  temporary  augmentation  of  the  IR  staff  will  also  be  considered  as  a  means 
to  increase  productivity. 

c.  EAs  may  be  conducted  using  either  an  audit-by-objectives  (fig  4-1)  or  risk  based  approach  (fig  4-2). 

d.  The  EA  final  report,  containing  management  comments,  will  be  forwarded  to  the  local  commander  for  review  and 
disposition  to  appropriate  staff  directors. 

e.  National  Guard  IR  officers  will  forward  EA  reports  through  the  USPEO  to  the  TAG  for  disposition  into  command 
channels. 

4-2.  Quick  response  audits 

a.  Quick  response  audits  (QRAs)  were  formerly  known  as  troubleshooting  engagements.  They  are  normally  per¬ 
formance  audits  of  a  very  limited  scope  (only  one  or  possibly  two  objectives)  that  are  often  unprogrammed.  They 
should  be  geared  toward  identifying  causes  and  recommendations  of  known  or  suspected  problems  or  opportunities  for 
improvement. 

b.  QRAs  are  usually  time  sensitive  and  are  normally  completed  in  a  matter  of  days  or  weeks. 

c.  GAS  will  be  met  to  the  extent  practical  when  performing  QRAs.  Standards  not  met  will  be  disclosed  in  the  report 
and  will  include  the  standards  not  followed,  the  reasons  for  not  following  the  standards,  and  any  material  effects  that 
not  following  the  standards  have  on  the  results  of  the  QRA. 

d.  Management  may  request  a  limited  distribution  of  the  audit  report  and  deviation  from  normal  staffing  policies. 
Restricted  distribution  is  permissible  when  authorized  by  the  local  commander.  The  IR  officer,  however,  will  retain  the 
right  to  notify  the  commander  when  problems  surface  that  may  significantly  impact  the  command  or  involve  gross 
mismanagement  or  illegal  activity.  Requesters  will  be  advised  of  this  responsibility  prior  to  initiating  the  QRA. 

e.  Additional  guidance  on  performing  QRAs  in  accordance  with  GAS  can  be  found  in  the  Internal  Review  Guide. 
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Figure  4-1.  Audit-by-Objectives  Methodology  Process 
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Chapter  5 

Consulting  and  Advisory  Services 
5-1.  Concept 

a.  Consulting  and  advisory  services  (C&AS)  include  all  engagements  performed  by  IR  staffs  that  are  not  perform¬ 
ance  or  financial  audits.  These  services  are  provided  to  meet  the  commander’s  or  other  customer’s  needs  and  include  a 
variety  of  consulting  and  other  services  that  employ  the  auditor’s  technical  skills,  education,  observations,  and 
experiences.  C&AS  will  meet  GAS  and  standards  established  by  the  ASA(FM&C)  for  non-audit  work.  C&AS  may 
include/be  defined  as  follows: 

(1)  Management  consulting  (for  example,  commenting  on  budget  actions,  plans  of  action,  and  command  decision 
packages  when  the  IR  staff’s  technical  skills,  education,  observations,  experiences,  and  knowledge  about  the  com¬ 
mand’s  organization,  circumstances  and  technical  matters  make  their  opinions  and  independent  perspective  of  value  to 
the  commander). 

(2)  Advisory  services  (for  example,  evaluating  management  proposals,  performing  cost  analyses,  assisting  the 
commander  and  staff  with  the  MCP,  performing  control  self  assessments,  etc.). 

(3)  Staff  and  other  support  services  (for  example,  serving  on  or  facilitating  Total  Quality  Management  (TQM) 
Process  Action  Teams  (PATs)  or  information  gathering). 

(4)  Transaction  services  (for  example,  pre-award  surveys,  procurement  support,  analysis  of  leases,  etc.). 

b.  IR  officers  should  ensure  that  the  staff  collectively  possesses  the  professional  capability  to  competently  perform 
the  service  requested  before  accepting  the  engagement. 

5-2.  Methodology 

Guidance  for  conducting  consulting  and  advisory  services  is  contained  in  the  DA  Internal  Review  Guide. 


Chapter  6 

Audit  Compliance  Services 
6-1.  Liaison 

a.  The  IR  office  serves  as  the  focal  point  for  monitoring  all  actions  related  to  audits,  surveys,  and  reviews  performed 
by  the  USAAA  and  external  audit  agencies  such  as  GAO;  DODIG;  and  commercial  audit  firms.  IR  offices  are 
normally  apprised  of  the  audit  objectives,  operating  plans,  time  schedules,  and  support  requirements  at  the  beginning  of 
the  audit.  This  information  will  be  passed  promptly  to  the  commander  and  to  those  senior  managers  whose  operations 
may  be  audited.  Guidance  for  performing  liaison  services  is  contained  in  the  DA  Internal  Review  Guide. 

b.  Liaison  services  consist  of  the  following — 

(1)  Coordinating  dates,  times,  and  locations  for  the  entrance  and  exit  conferences. 

(2)  Determining  the  points  of  contact  within  the  various  activities  and  functional  areas. 

(3)  Ensuring  that  administrative  support,  if  required,  is  provided  to  the  external  audit  representatives. 

(4)  Providing  advice  to  the  command  group  and  operating  managers  on  the  release  of  information. 

(5)  Maintaining  pertinent  records  (that  is,  dates  and  attendees  at  conferences  or  in-progress  reviews,  and  agreements 
reached).  These  recordkeeping  responsibilities  may  be  delegated  to  staff  functional  points  of  contact. 

(6)  Keeping  the  installation  or  activity  commander  fully  informed  on  the  status  of  ongoing  audits. 

(7)  Processing  draft  findings  and  recommendations,  draft  reports,  and  final  reports. 

(8)  Mediating  the  resolution  of  disagreements  between  command/management  and  the  auditors  relative  to  audit 
results,  as  needed. 

(9)  Ensuring  that  command  replies  to  draft  findings  and  recommendations  and  draft  reports  are  reviewed  for 
accuracy,  adequacy,  and  responsiveness,  have  been  properly  coordinated  with  responsible  command  elements,  and  meet 
assigned  suspense  dates,  as  prescribed  in  DA  audit  policies. 

6-2.  Follow-up  on  findings  and  recommendations 

a.  Audit  follow-up  is  the  collective  effort  made  to — 

(1)  Ensure  that  prompt  and  effective  corrective  action  is  taken  to  implement  recommendations  in  IR,  USAAA, 
DODIG,  GAO,  and  commercial  audit  reports. 

(2)  Ensure  that  controls  are  adequate  to  prevent  recurrence  of  deficiencies. 

b.  Eollow-ups  can  be  either  formal  or  informal. 

(1)  Eormal  follow-up  will  normally  be  conducted  on  findings  and  recommendations  based  on  AR  36-2.  A  formal 
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follow-up  will  involve  audit  work  to  determine  the  status  of  corrective  actions  and  whether  such  actions  have  been 
effective  in  eliminating  or  reducing  reported  conditions/risks.  It  may  also  involve  a  validation  of  projected  monetary 
benefits. 

(2)  Informal  follow-up  can  be  accomplished  on  less  significant  findings  and  recommendations.  Informal  procedures 
normally  involve  communication  with  and  written  support  documentation  obtained  from  the  manager  responsible  for 
effecting  corrective  actions  and  minimal  actual  audit  work.  For  example,  it  could  be  accomplished  by  obtaining  a  copy 
of  a  change  to  a  regulation  or  an  interim  policy  memorandum  and  reviewing  it.  Informal  follow-up  will  not  normally 
include  consequential  monetary  benefits.  The  use  of  informal  follow-up  techniques  can  often  save  substantial  audit  time 
and  reduce  travel  costs. 

c.  MACOMs  and  Army  Staff  agencies,  during  scheduled  QA  reviews  or  other  management-type  reviews  or 
evaluations  of  IR  operations,  will — 

(1)  Evaluate  the  effectiveness  of  follow-ups  performed  by  subordinate  installations  and  activities. 

(2)  Ensure  that  QA  visit  checklists  include  steps  to  determine  the  compliance  of  subordinate  IR  offices  with  audit 
follow-up  procedures  and  responsibilities. 

(3)  Establish  controls  to  ensure  that  all  subordinate  internal  review  activities  are  utilizing  an  audit  recommendation 
tracking  system. 

d.  IR  offices  will  provide  the  commander  and  his  or  her  staff  with  periodic  reports  on  the  status  of  corrective 
actions,  highlighting  those  actions  not  taken  or  delayed  and,  when  feasible,  describing  the  effects  of  failure  to  take  or 
delayed  corrective  actions.  Additional  command  emphasis  can  then  be  applied  to  ensure  that  the  required  corrective 
actions  are  taken  and  the  benefits  of  those  actions  are  realized. 

6-3.  Semiannual  reporting  requirements 

a.  Follow-up  status  report. 

(1)  All  IR  offices  are  required  to  update  the  status  of  corrective  actions  to  USAAA  audit  reports  not  less  than 
semiannually.  Input  is  to  be  accomplished  through  the  Internet  by  contacting  www.usaaaweb.aaa.army.mil. 

(2)  USAAA  is  responsible  for  the  follow-up  program  within  the  Army  and  will  also  provide  follow-up  status  reports 
to  external  agencies. 

b.  Semiannual  report.  Semiannually,  all  IR  officers  are  also  required  to  submit  data  concerning  their  operations 
through  their  next  higher  headquarters  to  the  Department  of  the  Army.  This  report  provides  IR  program  metrics, 
identifies  trends,  and  is  used  to  make  program  adjustments  when  necessary.  This  report  may  also  be  submitted  and 
reviewed  by  MACOMs  through  the  Internet.  Input  to  this  report  will  be  accomplished  through  the  Internet  by 
contacting  www.asafm.army.mil,  clicking  on  sidebar  links,  clicking  on  internal  review,  then  clicking  on  semiannual 
reports. 


Chapter  7 
Awards  Program 

7-1.  Concept 

a.  The  Assistant  Secretary  of  the  Army  (Einancial  Management  and  Comptroller)  has  established  an  Internal  Review 
Award  of  Excellence  Program.  The  awards  program  serves  to  recognize  those  internal  review  offices  that  are  providing 
outstanding  internal  auditing  services  to  their  commands.  Awards  will  be  presented  each  year  in  accordance  with  the 
criteria  prescribed  in  the  annual  Letter  of  Instruction.  Winners  will  be  selected  by  a  panel  chaired  by  the  DASA  (EO). 

b.  The  Assistant  Secretary  has  also  created  an  award  for  the  best  article  submitted  annually  to  the  IR  community’s 
quarterly  newsletter-The  IR  Journal.  This  award  seeks  to  acknowledge  all  contributors  to  the  publication  with  an 
Editor’s  Award  (certificate)  and  to  award  a  distinctive  plaque  to  the  IR  auditor  who  submitted  the  most  outstanding 
article.  All  articles  submitted  within  the  year  will  be  eligible  for  The  IR  Journal  award.  The  publication’s  editor  will 
convene  a  panel  of  three  judges  to  select  the  winner.  Articles  will  be  judged  based  on  the  following  criteria: 

(1)  Topic  of  greatest  interest  to  the  IR  community. 

(2)  Informative. 

(3)  Entertaining. 

(4)  Quality  of  writing. 

7-2.  Funding 

Eunding  for  award  materials  (plaques,  certificates,  and  frames)  will  be  from  funds  appropriated  and  available  to  the 
DASA  (EO). 
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References 

Section  I 

Required  Pubiications 

AR  11-2 

Management  Control.  (Cited  in  paras  l-4e(8)  and  3-2b.) 

AR  36-2 

Audit  Reports  and  Follow-up.  (Cited  in  paras  l-4d(2)  and  e(10)  and  6-2b(l).) 

Section  ii 

Reiated  Pubiications 

A  related  publication  is  merely  a  source  of  additional  information.  The  user  does  not  have  to  read  it  to  understand  this 
regulation. 

AR  36-5 

Auditing  Service  in  the  Department  of  the  Army 

Comptroller  General  of  the  United  States  Government  Auditing  Standards  (GAS) 

(www.gao.gov) 

Department  of  the  Army  Internal  Review  Guide 

(www.asafm.army.mil/fo/fod/ir/ir.asp) 

DOD  Directive  7600.2 

Audit  Policies  (http://web7.whs.osd.mil/corres.htm) 

DOD  Instruction  7600.6 

Audit  of  Nonappropriated  Fund  Instrumentalities  and  Related  Activities  (http://web7.whs.osd.mil/corres.htm) 

DOD  7600.7-M 

Internal  Audit  Manual  (www.dodig.osd.mil) 

DOD  Directive  7650.3 

Followup  on  General  Accounting  Office,  DOD  Inspector  General,  and  Internal  Audit  Reports  (http://web7.whs.osd.miF 
corres.htm) 

FM  100-22 

Installation  Management  (www.adtdl.army.miFatdls.htm) 

FM  101-5 

Staff  Organization  and  Operations  (www.adtdl.army.miFatdls.htm) 

American  Institute  of  Certified  Public  Accountants  (AICPA)  Standards 

(www.aicpa.org) 

Institue  of  Internal  Auditors  Internal  Audit  Standards 

(www.theiia.org) 

Section  III 
Prescribed  Forms 

This  section  contains  no  entries. 

Section  IV 
Referenced  Forms 

This  section  contains  no  entries. 
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Glossary 

Section  I 
Abbreviations 

AG 

Adjutant  General 
ASA  (FM&C) 

Assistant  Secretary  of  the  Army  (Financial  Management  &  Comptroller) 

ASI 

additional  skill  identifier 
ARNGUS 

Army  National  Guard  of  the  United  States 

COTR 

contracting  officer’s  technical  representative 

CPOS 

civilian  personnel  occupation  standard 

DASA  (FO) 

Deputy  Assistant  Secretary  of  the  Army  (Financial  Operations) 

DODI 

Department  of  Defense  instruction 

GAO 

General  Accounting  Office 

HQDA 

Headquarters,  Department  of  the  Army 

IR 

internal  review 
MACOMs 

major  Army  commands 

NAFI 

nonappropriated  fund  instrumentalities 
OASA  (FM&C) 

Office  of  the  Assistant  Secretary  of  the  Army  (Financial  Management  &  Comptroller) 

OMB 

Office  of  Management  and  Budget 

OTIG 

Office  of  The  Inspector  General 

QA 

quality  assurance 

SSEB 

source  selection  evaluation  board 
USAAA 

United  States  Army  Audit  Agency 


12 


AR  11-7  •  15  June  2001 


USAR 

United  States  Army  Reserve 

use 

United  States  Code 

USPFO 

United  States  Property  and  Fiscal  Officer 

Section  II 
Terms 

This  section  contains  no  entries. 


Section  III 

Special  Abbreviations  and  Terms 

This  publication  uses  the  following  abbreviations,  brevity  codes,  or  acronyms  not  contained  in  AR  310-50.  These 
include  use  for  electronic  publishing  media  and  computer  terminology. 

AAATRACK 

An  Automated  Audit  Recommendation  Tracking  System 
AEF 

audible  entry  file 

AICPA 

American  Institute  of  Certified  Public  Accountants 

CDFM 

certified  defense  financial  manager 

CFE 

certified  fraud  examiner 

CGEM 

certified  government  financial  manager 
CIA 

certified  internal  auditor 
CISA 

certified  information  systems  auditor 

C&AS 

consulting  &  advisory  services 

CPA 

certified  public  accountant 

CPE 

continuing  professional  education 

DODIG 

The  Inspector  General,  Department  of  Defense 
EA 

formal  audit 
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FRA 

findings  and  recommendations 


FSA 

full  scope  audits 
GAS 

Government  Auditing  Standards 

IMWRF 

installation  morale,  welfare,  and  recreation  fund 

MCP 

management  control  process 

PAT 

Process  Action  Team 

QRA 

quick  response  audit 

SAP 

Special  Access  Programs 

SI 

skill  identifier 


14 


AR  11-7  •  15  June  2001 


UNCLASSIFIED 


PIN  000000-000 


USAPA 

ELECTRONIC  PUBLISHING  SYSTEM 
OneCol  FORMATTER  .WIN32  Version  152 

PIN:  000000-000 

DATE:  06-20-01 

TIME:  16:26:22 

PAGES  SET:  18 

DATA  FILE:  C:\wincomp\rll-7.fil 

DOCUMENT:  AR  11-7 

DOC  STATUS:  NEW  PUBLICATION 


